ALSA: hiface: Add sanity checks for invalid EPs
authorTakashi Iwai <tiwai@suse.de>
Tue, 10 Oct 2017 10:32:56 +0000 (12:32 +0200)
committerTakashi Iwai <tiwai@suse.de>
Wed, 11 Oct 2017 14:59:27 +0000 (16:59 +0200)
hiface usb-audio driver sets up URBs containing the fixed endpoints
without validation.  This may end up with an oops-like kernel warning
when submitted.

For avoiding it, this patch adds the calls of the new sanity-check
helper for URBs.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/usb/hiface/pcm.c

index 175d8d6..396c317 100644 (file)
@@ -541,6 +541,8 @@ static int hiface_pcm_init_urb(struct pcm_urb *urb,
        usb_fill_bulk_urb(&urb->instance, chip->dev,
                          usb_sndbulkpipe(chip->dev, ep), (void *)urb->buffer,
                          PCM_PACKET_SIZE, handler, urb);
+       if (usb_urb_ep_type_check(&urb->instance))
+               return -EINVAL;
        init_usb_anchor(&urb->submitted);
 
        return 0;
@@ -599,9 +601,12 @@ int hiface_pcm_init(struct hiface_chip *chip, u8 extra_freq)
        mutex_init(&rt->stream_mutex);
        spin_lock_init(&rt->playback.lock);
 
-       for (i = 0; i < PCM_N_URBS; i++)
-               hiface_pcm_init_urb(&rt->out_urbs[i], chip, OUT_EP,
+       for (i = 0; i < PCM_N_URBS; i++) {
+               ret = hiface_pcm_init_urb(&rt->out_urbs[i], chip, OUT_EP,
                                    hiface_pcm_out_urb_handler);
+               if (ret < 0)
+                       return ret;
+       }
 
        ret = snd_pcm_new(chip->card, "USB-SPDIF Audio", 0, 1, 0, &pcm);
        if (ret < 0) {